diff --git a/api/download_test.go b/api/download_test.go
index c338f0ca..0ddea9b8 100644
--- a/api/download_test.go
+++ b/api/download_test.go
@@ -353,7 +353,7 @@ var (
 )
 
 func init() {
-	TestCredentialsFunc = func(input auth.Creds, subCommand string) (auth.Creds, error) {
+	TestCredentialsFunc = func(cfg *config.Configuration, input auth.Creds, subCommand string) (auth.Creds, error) {
 		output := make(auth.Creds)
 		for key, value := range input {
 			output[key] = value
diff --git a/api/http_lifecycle.go b/api/http_lifecycle.go
index ecac392c..b68efa7f 100644
--- a/api/http_lifecycle.go
+++ b/api/http_lifecycle.go
@@ -78,7 +78,7 @@ func (l *HttpLifecycle) Build(schema *RequestSchema) (*http.Request, error) {
 		return nil, err
 	}
 
-	if _, err = auth.GetCreds(req); err != nil {
+	if _, err = auth.GetCreds(config.Config, req); err != nil {
 		return nil, err
 	}
 
diff --git a/api/v1.go b/api/v1.go
index e6e87010..bbd7a82f 100644
--- a/api/v1.go
+++ b/api/v1.go
@@ -88,9 +88,9 @@ func NewRequest(method, oid string) (*http.Request, error) {
 			operation = "upload"
 		}
 	}
-	endpoint := config.Config.Endpoint(operation)
 
-	res, err := auth.SshAuthenticate(endpoint, operation, oid)
+	cfg := config.Config
+	res, endpoint, err := auth.SshAuthenticate(cfg, operation, oid)
 	if err != nil {
 		tracerx.Printf("ssh: attempted with %s.  Error: %s",
 			endpoint.SshUserAndHost, err.Error(),
@@ -117,9 +117,8 @@ func NewRequest(method, oid string) (*http.Request, error) {
 }
 
 func NewBatchRequest(operation string) (*http.Request, error) {
-	endpoint := config.Config.Endpoint(operation)
-
-	res, err := auth.SshAuthenticate(endpoint, operation, "")
+	cfg := config.Config
+	res, endpoint, err := auth.SshAuthenticate(cfg, operation, "")
 	if err != nil {
 		tracerx.Printf("ssh: %s attempted with %s.  Error: %s",
 			operation, endpoint.SshUserAndHost, err.Error(),
diff --git a/auth/credentials.go b/auth/credentials.go
index 77410ae6..41b4b581 100644
--- a/auth/credentials.go
+++ b/auth/credentials.go
@@ -28,12 +28,12 @@ import (
 // This prefers the Git remote URL for checking credentials so that users only
 // have to enter their passwords once for Git and Git LFS. It uses the same
 // URL path that Git does, in case 'useHttpPath' is enabled in the Git config.
-func GetCreds(req *http.Request) (Creds, error) {
-	if skipCredsCheck(req) {
+func GetCreds(cfg *config.Configuration, req *http.Request) (Creds, error) {
+	if skipCredsCheck(cfg, req) {
 		return nil, nil
 	}
 
-	credsUrl, err := getCredURLForAPI(req)
+	credsUrl, err := getCredURLForAPI(cfg, req)
 	if err != nil {
 		return nil, errutil.Error(err)
 	}
@@ -42,16 +42,16 @@ func GetCreds(req *http.Request) (Creds, error) {
 		return nil, nil
 	}
 
-	if setCredURLFromNetrc(req) {
+	if setCredURLFromNetrc(cfg, req) {
 		return nil, nil
 	}
 
-	return fillCredentials(req, credsUrl)
+	return fillCredentials(cfg, req, credsUrl)
 }
 
-func getCredURLForAPI(req *http.Request) (*url.URL, error) {
+func getCredURLForAPI(cfg *config.Configuration, req *http.Request) (*url.URL, error) {
 	operation := GetOperationForRequest(req)
-	apiUrl, err := url.Parse(config.Config.Endpoint(operation).Url)
+	apiUrl, err := url.Parse(cfg.Endpoint(operation).Url)
 	if err != nil {
 		return nil, err
 	}
@@ -63,13 +63,13 @@ func getCredURLForAPI(req *http.Request) (*url.URL, error) {
 		return req.URL, nil
 	}
 
-	if setRequestAuthFromUrl(req, apiUrl) {
+	if setRequestAuthFromUrl(cfg, req, apiUrl) {
 		return nil, nil
 	}
 
 	credsUrl := apiUrl
-	if len(config.Config.CurrentRemote) > 0 {
-		if u := config.Config.GitRemoteUrl(config.Config.CurrentRemote, operation == "upload"); u != "" {
+	if len(cfg.CurrentRemote) > 0 {
+		if u := cfg.GitRemoteUrl(cfg.CurrentRemote, operation == "upload"); u != "" {
 			gitRemoteUrl, err := url.Parse(u)
 			if err != nil {
 				return nil, err
@@ -78,7 +78,7 @@ func getCredURLForAPI(req *http.Request) (*url.URL, error) {
 			if gitRemoteUrl.Scheme == apiUrl.Scheme &&
 				gitRemoteUrl.Host == apiUrl.Host {
 
-				if setRequestAuthFromUrl(req, gitRemoteUrl) {
+				if setRequestAuthFromUrl(cfg, req, gitRemoteUrl) {
 					return nil, nil
 				}
 
@@ -89,7 +89,7 @@ func getCredURLForAPI(req *http.Request) (*url.URL, error) {
 	return credsUrl, nil
 }
 
-func setCredURLFromNetrc(req *http.Request) bool {
+func setCredURLFromNetrc(cfg *config.Configuration, req *http.Request) bool {
 	hostname := req.URL.Host
 	var host string
 
@@ -104,7 +104,7 @@ func setCredURLFromNetrc(req *http.Request) bool {
 		host = hostname
 	}
 
-	machine, err := config.Config.FindNetrcHost(host)
+	machine, err := cfg.FindNetrcHost(host)
 	if err != nil {
 		tracerx.Printf("netrc: error finding match for %q: %s", hostname, err)
 		return false
@@ -114,12 +114,12 @@ func setCredURLFromNetrc(req *http.Request) bool {
 		return false
 	}
 
-	setRequestAuth(req, machine.Login, machine.Password)
+	setRequestAuth(cfg, req, machine.Login, machine.Password)
 	return true
 }
 
-func skipCredsCheck(req *http.Request) bool {
-	if config.Config.NtlmAccess(GetOperationForRequest(req)) {
+func skipCredsCheck(cfg *config.Configuration, req *http.Request) bool {
+	if cfg.NtlmAccess(GetOperationForRequest(req)) {
 		return false
 	}
 
@@ -131,14 +131,14 @@ func skipCredsCheck(req *http.Request) bool {
 	return len(q["token"]) > 0
 }
 
-func fillCredentials(req *http.Request, u *url.URL) (Creds, error) {
+func fillCredentials(cfg *config.Configuration, req *http.Request, u *url.URL) (Creds, error) {
 	path := strings.TrimPrefix(u.Path, "/")
 	input := Creds{"protocol": u.Scheme, "host": u.Host, "path": path}
 	if u.User != nil && u.User.Username() != "" {
 		input["username"] = u.User.Username()
 	}
 
-	creds, err := execCreds(input, "fill")
+	creds, err := execCreds(cfg, input, "fill")
 	if creds == nil || len(creds) < 1 {
 		errmsg := fmt.Sprintf("Git credentials for %s not found", u)
 		if err != nil {
@@ -154,22 +154,22 @@ func fillCredentials(req *http.Request, u *url.URL) (Creds, error) {
 	}
 
 	tracerx.Printf("Filled credentials for %s", u)
-	setRequestAuth(req, creds["username"], creds["password"])
+	setRequestAuth(cfg, req, creds["username"], creds["password"])
 
 	return creds, err
 }
 
-func SaveCredentials(creds Creds, res *http.Response) {
+func SaveCredentials(cfg *config.Configuration, creds Creds, res *http.Response) {
 	if creds == nil {
 		return
 	}
 
 	switch res.StatusCode {
 	case 401, 403:
-		execCreds(creds, "reject")
+		execCreds(cfg, creds, "reject")
 	default:
 		if res.StatusCode < 300 {
-			execCreds(creds, "approve")
+			execCreds(cfg, creds, "approve")
 		}
 	}
 }
@@ -190,9 +190,9 @@ func (c Creds) Buffer() *bytes.Buffer {
 }
 
 // Credentials function which will be called whenever credentials are requested
-type CredentialFunc func(Creds, string) (Creds, error)
+type CredentialFunc func(*config.Configuration, Creds, string) (Creds, error)
 
-func execCredsCommand(input Creds, subCommand string) (Creds, error) {
+func execCredsCommand(cfg *config.Configuration, input Creds, subCommand string) (Creds, error) {
 	output := new(bytes.Buffer)
 	cmd := exec.Command("git", "credential", subCommand)
 	cmd.Stdin = input.Buffer()
@@ -212,7 +212,7 @@ func execCredsCommand(input Creds, subCommand string) (Creds, error) {
 	}
 
 	if _, ok := err.(*exec.ExitError); ok {
-		if !config.Config.GetenvBool("GIT_TERMINAL_PROMPT", true) {
+		if !cfg.GetenvBool("GIT_TERMINAL_PROMPT", true) {
 			return nil, fmt.Errorf("Change the GIT_TERMINAL_PROMPT env var to be prompted to enter your credentials for %s://%s.",
 				input["protocol"], input["host"])
 		}
@@ -240,11 +240,11 @@ func execCredsCommand(input Creds, subCommand string) (Creds, error) {
 	return creds, nil
 }
 
-func setRequestAuthFromUrl(req *http.Request, u *url.URL) bool {
-	if !config.Config.NtlmAccess(GetOperationForRequest(req)) && u.User != nil {
+func setRequestAuthFromUrl(cfg *config.Configuration, req *http.Request, u *url.URL) bool {
+	if !cfg.NtlmAccess(GetOperationForRequest(req)) && u.User != nil {
 		if pass, ok := u.User.Password(); ok {
 			fmt.Fprintln(os.Stderr, "warning: current Git remote contains credentials")
-			setRequestAuth(req, u.User.Username(), pass)
+			setRequestAuth(cfg, req, u.User.Username(), pass)
 			return true
 		}
 	}
@@ -252,8 +252,8 @@ func setRequestAuthFromUrl(req *http.Request, u *url.URL) bool {
 	return false
 }
 
-func setRequestAuth(req *http.Request, user, pass string) {
-	if config.Config.NtlmAccess(GetOperationForRequest(req)) {
+func setRequestAuth(cfg *config.Configuration, req *http.Request, user, pass string) {
+	if cfg.NtlmAccess(GetOperationForRequest(req)) {
 		return
 	}
 
diff --git a/auth/credentials_test.go b/auth/credentials_test.go
index 7663c259..07c979cb 100644
--- a/auth/credentials_test.go
+++ b/auth/credentials_test.go
@@ -14,6 +14,7 @@ import (
 
 func TestGetCredentialsForApi(t *testing.T) {
 	SetupTestCredentialsFunc()
+	defer RestoreCredentialsFunc()
 
 	checkGetCredentials(t, GetCreds, []*getCredentialCheck{
 		{
@@ -113,8 +114,6 @@ func TestGetCredentialsForApi(t *testing.T) {
 			SkipAuth: true,
 		},
 	})
-
-	RestoreCredentialsFunc()
 }
 
 type fakeNetrc struct{}
@@ -128,8 +127,10 @@ func (n *fakeNetrc) FindMachine(host string) *netrc.Machine {
 
 func TestNetrcWithHostAndPort(t *testing.T) {
 	SetupTestCredentialsFunc()
+	defer RestoreCredentialsFunc()
 
-	config.Config.SetNetrc(&fakeNetrc{})
+	cfg := config.NewConfig()
+	cfg.SetNetrc(&fakeNetrc{})
 	u, err := url.Parse("http://some-host:123/foo/bar")
 	if err != nil {
 		t.Fatal(err)
@@ -140,7 +141,7 @@ func TestNetrcWithHostAndPort(t *testing.T) {
 		Header: http.Header{},
 	}
 
-	if !setCredURLFromNetrc(req) {
+	if !setCredURLFromNetrc(cfg, req) {
 		t.Fatal("no netrc match")
 	}
 
@@ -148,14 +149,14 @@ func TestNetrcWithHostAndPort(t *testing.T) {
 	if auth != "Basic YWJjOmRlZg==" {
 		t.Fatalf("bad basic auth: %q", auth)
 	}
-
-	RestoreCredentialsFunc()
 }
 
 func TestNetrcWithHost(t *testing.T) {
 	SetupTestCredentialsFunc()
+	defer RestoreCredentialsFunc()
 
-	config.Config.SetNetrc(&fakeNetrc{})
+	cfg := config.NewConfig()
+	cfg.SetNetrc(&fakeNetrc{})
 	u, err := url.Parse("http://some-host/foo/bar")
 	if err != nil {
 		t.Fatal(err)
@@ -166,7 +167,7 @@ func TestNetrcWithHost(t *testing.T) {
 		Header: http.Header{},
 	}
 
-	if !setCredURLFromNetrc(req) {
+	if !setCredURLFromNetrc(cfg, req) {
 		t.Fatalf("no netrc match")
 	}
 
@@ -174,14 +175,14 @@ func TestNetrcWithHost(t *testing.T) {
 	if auth != "Basic YWJjOmRlZg==" {
 		t.Fatalf("bad basic auth: %q", auth)
 	}
-
-	RestoreCredentialsFunc()
 }
 
 func TestNetrcWithBadHost(t *testing.T) {
 	SetupTestCredentialsFunc()
+	defer RestoreCredentialsFunc()
 
-	config.Config.SetNetrc(&fakeNetrc{})
+	cfg := config.NewConfig()
+	cfg.SetNetrc(&fakeNetrc{})
 	u, err := url.Parse("http://other-host/foo/bar")
 	if err != nil {
 		t.Fatal(err)
@@ -192,7 +193,7 @@ func TestNetrcWithBadHost(t *testing.T) {
 		Header: http.Header{},
 	}
 
-	if setCredURLFromNetrc(req) {
+	if setCredURLFromNetrc(cfg, req) {
 		t.Fatalf("unexpected netrc match")
 	}
 
@@ -200,18 +201,16 @@ func TestNetrcWithBadHost(t *testing.T) {
 	if auth != "" {
 		t.Fatalf("bad basic auth: %q", auth)
 	}
-
-	RestoreCredentialsFunc()
 }
 
-func checkGetCredentials(t *testing.T, getCredsFunc func(*http.Request) (Creds, error), checks []*getCredentialCheck) {
-	existingRemote := config.Config.CurrentRemote
+func checkGetCredentials(t *testing.T, getCredsFunc func(*config.Configuration, *http.Request) (Creds, error), checks []*getCredentialCheck) {
 	for _, check := range checks {
 		t.Logf("Checking %q", check.Desc)
-		config.Config.CurrentRemote = check.CurrentRemote
+		cfg := config.NewConfig()
+		cfg.CurrentRemote = check.CurrentRemote
 
 		for key, value := range check.Config {
-			config.Config.SetConfig(key, value)
+			cfg.SetConfig(key, value)
 		}
 
 		req, err := http.NewRequest(check.Method, check.Href, nil)
@@ -224,7 +223,7 @@ func checkGetCredentials(t *testing.T, getCredsFunc func(*http.Request) (Creds,
 			req.Header.Set(key, value)
 		}
 
-		creds, err := getCredsFunc(req)
+		creds, err := getCredsFunc(cfg, req)
 		if err != nil {
 			t.Errorf("[%s] %s", check.Desc, err)
 			continue
@@ -275,9 +274,6 @@ func checkGetCredentials(t *testing.T, getCredsFunc func(*http.Request) (Creds,
 				t.Errorf("[%s] Bad Authorization. Expected '%s', got '%s'", check.Desc, expected, reqAuth)
 			}
 		}
-
-		config.Config.ResetConfig()
-		config.Config.CurrentRemote = existingRemote
 	}
 }
 
@@ -308,7 +304,7 @@ var (
 )
 
 func init() {
-	TestCredentialsFunc = func(input Creds, subCommand string) (Creds, error) {
+	TestCredentialsFunc = func(cfg *config.Configuration, input Creds, subCommand string) (Creds, error) {
 		output := make(Creds)
 		for key, value := range input {
 			output[key] = value
diff --git a/auth/ssh.go b/auth/ssh.go
index b8fc3b96..30b27220 100644
--- a/auth/ssh.go
+++ b/auth/ssh.go
@@ -19,20 +19,20 @@ type SshAuthResponse struct {
 	ExpiresAt string            `json:"expires_at"`
 }
 
-func SshAuthenticate(endpoint config.Endpoint, operation, oid string) (SshAuthResponse, error) {
-
+func SshAuthenticate(cfg *config.Configuration, operation, oid string) (SshAuthResponse, config.Endpoint, error) {
 	// This is only used as a fallback where the Git URL is SSH but server doesn't support a full SSH binary protocol
 	// and therefore we derive a HTTPS endpoint for binaries instead; but check authentication here via SSH
 
+	endpoint := cfg.Endpoint(operation)
 	res := SshAuthResponse{}
 	if len(endpoint.SshUserAndHost) == 0 {
-		return res, nil
+		return res, endpoint, nil
 	}
 
 	tracerx.Printf("ssh: %s git-lfs-authenticate %s %s %s",
 		endpoint.SshUserAndHost, endpoint.SshPath, operation, oid)
 
-	exe, args := sshGetExeAndArgs(endpoint)
+	exe, args := sshGetExeAndArgs(cfg, endpoint)
 	args = append(args,
 		fmt.Sprintf("git-lfs-authenticate %s %s %s", endpoint.SshPath, operation, oid))
 
@@ -56,12 +56,12 @@ func SshAuthenticate(endpoint config.Endpoint, operation, oid string) (SshAuthRe
 		err = json.Unmarshal(outbuf.Bytes(), &res)
 	}
 
-	return res, err
+	return res, endpoint, err
 }
 
 // Return the executable name for ssh on this machine and the base args
 // Base args includes port settings, user/host, everything pre the command to execute
-func sshGetExeAndArgs(endpoint config.Endpoint) (exe string, baseargs []string) {
+func sshGetExeAndArgs(cfg *config.Configuration, endpoint config.Endpoint) (exe string, baseargs []string) {
 	if len(endpoint.SshUserAndHost) == 0 {
 		return "", nil
 	}
@@ -69,8 +69,8 @@ func sshGetExeAndArgs(endpoint config.Endpoint) (exe string, baseargs []string)
 	isPlink := false
 	isTortoise := false
 
-	ssh := config.Config.Getenv("GIT_SSH")
-	cmdArgs := strings.Fields(config.Config.Getenv("GIT_SSH_COMMAND"))
+	ssh := cfg.Getenv("GIT_SSH")
+	cmdArgs := strings.Fields(cfg.Getenv("GIT_SSH_COMMAND"))
 	if len(cmdArgs) > 0 {
 		ssh = cmdArgs[0]
 		cmdArgs = cmdArgs[1:]
diff --git a/auth/ssh_test.go b/auth/ssh_test.go
index d73878ae..8d928cac 100644
--- a/auth/ssh_test.go
+++ b/auth/ssh_test.go
@@ -9,200 +9,213 @@ import (
 )
 
 func TestSSHGetExeAndArgsSsh(t *testing.T) {
-	endpoint := config.Config.Endpoint("download")
+	cfg := config.NewConfig()
+	endpoint := cfg.Endpoint("download")
 	endpoint.SshUserAndHost = "user@foo.com"
-	oldGITSSHCommand := config.Config.Getenv("GIT_SSH_COMMAND")
-	config.Config.Setenv("GIT_SSH_COMMAND", "")
-	oldGITSSH := config.Config.Getenv("GIT_SSH")
-	config.Config.Setenv("GIT_SSH", "")
-	exe, args := sshGetExeAndArgs(endpoint)
+	oldGITSSHCommand := cfg.Getenv("GIT_SSH_COMMAND")
+	cfg.Setenv("GIT_SSH_COMMAND", "")
+	oldGITSSH := cfg.Getenv("GIT_SSH")
+	cfg.Setenv("GIT_SSH", "")
+	exe, args := sshGetExeAndArgs(cfg, endpoint)
 	assert.Equal(t, "ssh", exe)
 	assert.Equal(t, []string{"user@foo.com"}, args)
 
-	config.Config.Setenv("GIT_SSH", oldGITSSH)
-	config.Config.Setenv("GIT_SSH_COMMAND", oldGITSSHCommand)
+	cfg.Setenv("GIT_SSH", oldGITSSH)
+	cfg.Setenv("GIT_SSH_COMMAND", oldGITSSHCommand)
 }
 
 func TestSSHGetExeAndArgsSshCustomPort(t *testing.T) {
-	endpoint := config.Config.Endpoint("download")
+	cfg := config.NewConfig()
+	endpoint := cfg.Endpoint("download")
 	endpoint.SshUserAndHost = "user@foo.com"
 	endpoint.SshPort = "8888"
-	oldGITSSHCommand := config.Config.Getenv("GIT_SSH_COMMAND")
-	config.Config.Setenv("GIT_SSH_COMMAND", "")
-	oldGITSSH := config.Config.Getenv("GIT_SSH")
-	config.Config.Setenv("GIT_SSH", "")
-	exe, args := sshGetExeAndArgs(endpoint)
+	oldGITSSHCommand := cfg.Getenv("GIT_SSH_COMMAND")
+	cfg.Setenv("GIT_SSH_COMMAND", "")
+	oldGITSSH := cfg.Getenv("GIT_SSH")
+	cfg.Setenv("GIT_SSH", "")
+	exe, args := sshGetExeAndArgs(cfg, endpoint)
 	assert.Equal(t, "ssh", exe)
 	assert.Equal(t, []string{"-p", "8888", "user@foo.com"}, args)
 
-	config.Config.Setenv("GIT_SSH", oldGITSSH)
-	config.Config.Setenv("GIT_SSH_COMMAND", oldGITSSHCommand)
+	cfg.Setenv("GIT_SSH", oldGITSSH)
+	cfg.Setenv("GIT_SSH_COMMAND", oldGITSSHCommand)
 }
 
 func TestSSHGetExeAndArgsPlink(t *testing.T) {
-	endpoint := config.Config.Endpoint("download")
+	cfg := config.NewConfig()
+	endpoint := cfg.Endpoint("download")
 	endpoint.SshUserAndHost = "user@foo.com"
-	oldGITSSHCommand := config.Config.Getenv("GIT_SSH_COMMAND")
-	config.Config.Setenv("GIT_SSH_COMMAND", "")
-	oldGITSSH := config.Config.Getenv("GIT_SSH")
+	oldGITSSHCommand := cfg.Getenv("GIT_SSH_COMMAND")
+	cfg.Setenv("GIT_SSH_COMMAND", "")
+	oldGITSSH := cfg.Getenv("GIT_SSH")
 	// this will run on non-Windows platforms too but no biggie
 	plink := filepath.Join("Users", "joebloggs", "bin", "plink.exe")
-	config.Config.Setenv("GIT_SSH", plink)
-	exe, args := sshGetExeAndArgs(endpoint)
+	cfg.Setenv("GIT_SSH", plink)
+	exe, args := sshGetExeAndArgs(cfg, endpoint)
 	assert.Equal(t, plink, exe)
 	assert.Equal(t, []string{"user@foo.com"}, args)
 
-	config.Config.Setenv("GIT_SSH", oldGITSSH)
-	config.Config.Setenv("GIT_SSH_COMMAND", oldGITSSHCommand)
+	cfg.Setenv("GIT_SSH", oldGITSSH)
+	cfg.Setenv("GIT_SSH_COMMAND", oldGITSSHCommand)
 }
 
 func TestSSHGetExeAndArgsPlinkCustomPort(t *testing.T) {
-	endpoint := config.Config.Endpoint("download")
+	cfg := config.NewConfig()
+	endpoint := cfg.Endpoint("download")
 	endpoint.SshUserAndHost = "user@foo.com"
 	endpoint.SshPort = "8888"
-	oldGITSSHCommand := config.Config.Getenv("GIT_SSH_COMMAND")
-	config.Config.Setenv("GIT_SSH_COMMAND", "")
-	oldGITSSH := config.Config.Getenv("GIT_SSH")
+	oldGITSSHCommand := cfg.Getenv("GIT_SSH_COMMAND")
+	cfg.Setenv("GIT_SSH_COMMAND", "")
+	oldGITSSH := cfg.Getenv("GIT_SSH")
 	// this will run on non-Windows platforms too but no biggie
 	plink := filepath.Join("Users", "joebloggs", "bin", "plink")
-	config.Config.Setenv("GIT_SSH", plink)
-	exe, args := sshGetExeAndArgs(endpoint)
+	cfg.Setenv("GIT_SSH", plink)
+	exe, args := sshGetExeAndArgs(cfg, endpoint)
 	assert.Equal(t, plink, exe)
 	assert.Equal(t, []string{"-P", "8888", "user@foo.com"}, args)
 
-	config.Config.Setenv("GIT_SSH", oldGITSSH)
-	config.Config.Setenv("GIT_SSH_COMMAND", oldGITSSHCommand)
+	cfg.Setenv("GIT_SSH", oldGITSSH)
+	cfg.Setenv("GIT_SSH_COMMAND", oldGITSSHCommand)
 }
 
 func TestSSHGetExeAndArgsTortoisePlink(t *testing.T) {
-	endpoint := config.Config.Endpoint("download")
+	cfg := config.NewConfig()
+	endpoint := cfg.Endpoint("download")
 	endpoint.SshUserAndHost = "user@foo.com"
-	oldGITSSHCommand := config.Config.Getenv("GIT_SSH_COMMAND")
-	config.Config.Setenv("GIT_SSH_COMMAND", "")
-	oldGITSSH := config.Config.Getenv("GIT_SSH")
+	oldGITSSHCommand := cfg.Getenv("GIT_SSH_COMMAND")
+	cfg.Setenv("GIT_SSH_COMMAND", "")
+	oldGITSSH := cfg.Getenv("GIT_SSH")
 	// this will run on non-Windows platforms too but no biggie
 	plink := filepath.Join("Users", "joebloggs", "bin", "tortoiseplink.exe")
-	config.Config.Setenv("GIT_SSH", plink)
-	exe, args := sshGetExeAndArgs(endpoint)
+	cfg.Setenv("GIT_SSH", plink)
+	exe, args := sshGetExeAndArgs(cfg, endpoint)
 	assert.Equal(t, plink, exe)
 	assert.Equal(t, []string{"-batch", "user@foo.com"}, args)
 
-	config.Config.Setenv("GIT_SSH", oldGITSSH)
-	config.Config.Setenv("GIT_SSH_COMMAND", oldGITSSHCommand)
+	cfg.Setenv("GIT_SSH", oldGITSSH)
+	cfg.Setenv("GIT_SSH_COMMAND", oldGITSSHCommand)
 }
 
 func TestSSHGetExeAndArgsTortoisePlinkCustomPort(t *testing.T) {
-	endpoint := config.Config.Endpoint("download")
+	cfg := config.NewConfig()
+	endpoint := cfg.Endpoint("download")
 	endpoint.SshUserAndHost = "user@foo.com"
 	endpoint.SshPort = "8888"
-	oldGITSSHCommand := config.Config.Getenv("GIT_SSH_COMMAND")
-	config.Config.Setenv("GIT_SSH_COMMAND", "")
-	oldGITSSH := config.Config.Getenv("GIT_SSH")
+	oldGITSSHCommand := cfg.Getenv("GIT_SSH_COMMAND")
+	cfg.Setenv("GIT_SSH_COMMAND", "")
+	oldGITSSH := cfg.Getenv("GIT_SSH")
 	// this will run on non-Windows platforms too but no biggie
 	plink := filepath.Join("Users", "joebloggs", "bin", "tortoiseplink")
-	config.Config.Setenv("GIT_SSH", plink)
-	exe, args := sshGetExeAndArgs(endpoint)
+	cfg.Setenv("GIT_SSH", plink)
+	exe, args := sshGetExeAndArgs(cfg, endpoint)
 	assert.Equal(t, plink, exe)
 	assert.Equal(t, []string{"-batch", "-P", "8888", "user@foo.com"}, args)
 
-	config.Config.Setenv("GIT_SSH", oldGITSSH)
-	config.Config.Setenv("GIT_SSH_COMMAND", oldGITSSHCommand)
+	cfg.Setenv("GIT_SSH", oldGITSSH)
+	cfg.Setenv("GIT_SSH_COMMAND", oldGITSSHCommand)
 }
 
 func TestSSHGetExeAndArgsSshCommandPrecedence(t *testing.T) {
-	endpoint := config.Config.Endpoint("download")
+	cfg := config.NewConfig()
+	endpoint := cfg.Endpoint("download")
 	endpoint.SshUserAndHost = "user@foo.com"
-	oldGITSSHCommand := config.Config.Getenv("GIT_SSH_COMMAND")
-	config.Config.Setenv("GIT_SSH_COMMAND", "sshcmd")
-	oldGITSSH := config.Config.Getenv("GIT_SSH")
-	config.Config.Setenv("GIT_SSH", "bad")
-	exe, args := sshGetExeAndArgs(endpoint)
+	oldGITSSHCommand := cfg.Getenv("GIT_SSH_COMMAND")
+	cfg.Setenv("GIT_SSH_COMMAND", "sshcmd")
+	oldGITSSH := cfg.Getenv("GIT_SSH")
+	cfg.Setenv("GIT_SSH", "bad")
+	exe, args := sshGetExeAndArgs(cfg, endpoint)
 	assert.Equal(t, "sshcmd", exe)
 	assert.Equal(t, []string{"user@foo.com"}, args)
 
-	config.Config.Setenv("GIT_SSH", oldGITSSH)
-	config.Config.Setenv("GIT_SSH_COMMAND", oldGITSSHCommand)
+	cfg.Setenv("GIT_SSH", oldGITSSH)
+	cfg.Setenv("GIT_SSH_COMMAND", oldGITSSHCommand)
 }
 
 func TestSSHGetExeAndArgsSshCommandArgs(t *testing.T) {
-	endpoint := config.Config.Endpoint("download")
+	cfg := config.NewConfig()
+	endpoint := cfg.Endpoint("download")
 	endpoint.SshUserAndHost = "user@foo.com"
-	oldGITSSHCommand := config.Config.Getenv("GIT_SSH_COMMAND")
-	config.Config.Setenv("GIT_SSH_COMMAND", "sshcmd --args 1")
-	exe, args := sshGetExeAndArgs(endpoint)
+	oldGITSSHCommand := cfg.Getenv("GIT_SSH_COMMAND")
+	cfg.Setenv("GIT_SSH_COMMAND", "sshcmd --args 1")
+	exe, args := sshGetExeAndArgs(cfg, endpoint)
 	assert.Equal(t, "sshcmd", exe)
 	assert.Equal(t, []string{"--args", "1", "user@foo.com"}, args)
 
-	config.Config.Setenv("GIT_SSH_COMMAND", oldGITSSHCommand)
+	cfg.Setenv("GIT_SSH_COMMAND", oldGITSSHCommand)
 }
 
 func TestSSHGetExeAndArgsSshCommandCustomPort(t *testing.T) {
-	endpoint := config.Config.Endpoint("download")
+	cfg := config.NewConfig()
+	endpoint := cfg.Endpoint("download")
 	endpoint.SshUserAndHost = "user@foo.com"
 	endpoint.SshPort = "8888"
-	oldGITSSHCommand := config.Config.Getenv("GIT_SSH_COMMAND")
-	config.Config.Setenv("GIT_SSH_COMMAND", "sshcmd")
-	exe, args := sshGetExeAndArgs(endpoint)
+	oldGITSSHCommand := cfg.Getenv("GIT_SSH_COMMAND")
+	cfg.Setenv("GIT_SSH_COMMAND", "sshcmd")
+	exe, args := sshGetExeAndArgs(cfg, endpoint)
 	assert.Equal(t, "sshcmd", exe)
 	assert.Equal(t, []string{"-p", "8888", "user@foo.com"}, args)
 
-	config.Config.Setenv("GIT_SSH_COMMAND", oldGITSSHCommand)
+	cfg.Setenv("GIT_SSH_COMMAND", oldGITSSHCommand)
 }
 
 func TestSSHGetExeAndArgsPlinkCommand(t *testing.T) {
-	endpoint := config.Config.Endpoint("download")
+	cfg := config.NewConfig()
+	endpoint := cfg.Endpoint("download")
 	endpoint.SshUserAndHost = "user@foo.com"
-	oldGITSSHCommand := config.Config.Getenv("GIT_SSH_COMMAND")
+	oldGITSSHCommand := cfg.Getenv("GIT_SSH_COMMAND")
 	// this will run on non-Windows platforms too but no biggie
 	plink := filepath.Join("Users", "joebloggs", "bin", "plink.exe")
-	config.Config.Setenv("GIT_SSH_COMMAND", plink)
-	exe, args := sshGetExeAndArgs(endpoint)
+	cfg.Setenv("GIT_SSH_COMMAND", plink)
+	exe, args := sshGetExeAndArgs(cfg, endpoint)
 	assert.Equal(t, plink, exe)
 	assert.Equal(t, []string{"user@foo.com"}, args)
 
-	config.Config.Setenv("GIT_SSH_COMMAND", oldGITSSHCommand)
+	cfg.Setenv("GIT_SSH_COMMAND", oldGITSSHCommand)
 }
 
 func TestSSHGetExeAndArgsPlinkCommandCustomPort(t *testing.T) {
-	endpoint := config.Config.Endpoint("download")
+	cfg := config.NewConfig()
+	endpoint := cfg.Endpoint("download")
 	endpoint.SshUserAndHost = "user@foo.com"
 	endpoint.SshPort = "8888"
-	oldGITSSHCommand := config.Config.Getenv("GIT_SSH_COMMAND")
+	oldGITSSHCommand := cfg.Getenv("GIT_SSH_COMMAND")
 	// this will run on non-Windows platforms too but no biggie
 	plink := filepath.Join("Users", "joebloggs", "bin", "plink")
-	config.Config.Setenv("GIT_SSH_COMMAND", plink)
-	exe, args := sshGetExeAndArgs(endpoint)
+	cfg.Setenv("GIT_SSH_COMMAND", plink)
+	exe, args := sshGetExeAndArgs(cfg, endpoint)
 	assert.Equal(t, plink, exe)
 	assert.Equal(t, []string{"-P", "8888", "user@foo.com"}, args)
 
-	config.Config.Setenv("GIT_SSH_COMMAND", oldGITSSHCommand)
+	cfg.Setenv("GIT_SSH_COMMAND", oldGITSSHCommand)
 }
 
 func TestSSHGetExeAndArgsTortoisePlinkCommand(t *testing.T) {
-	endpoint := config.Config.Endpoint("download")
+	cfg := config.NewConfig()
+	endpoint := cfg.Endpoint("download")
 	endpoint.SshUserAndHost = "user@foo.com"
-	oldGITSSHCommand := config.Config.Getenv("GIT_SSH_COMMAND")
+	oldGITSSHCommand := cfg.Getenv("GIT_SSH_COMMAND")
 	// this will run on non-Windows platforms too but no biggie
 	plink := filepath.Join("Users", "joebloggs", "bin", "tortoiseplink.exe")
-	config.Config.Setenv("GIT_SSH_COMMAND", plink)
-	exe, args := sshGetExeAndArgs(endpoint)
+	cfg.Setenv("GIT_SSH_COMMAND", plink)
+	exe, args := sshGetExeAndArgs(cfg, endpoint)
 	assert.Equal(t, plink, exe)
 	assert.Equal(t, []string{"-batch", "user@foo.com"}, args)
 
-	config.Config.Setenv("GIT_SSH_COMMAND", oldGITSSHCommand)
+	cfg.Setenv("GIT_SSH_COMMAND", oldGITSSHCommand)
 }
 
 func TestSSHGetExeAndArgsTortoisePlinkCommandCustomPort(t *testing.T) {
-	endpoint := config.Config.Endpoint("download")
+	cfg := config.NewConfig()
+	endpoint := cfg.Endpoint("download")
 	endpoint.SshUserAndHost = "user@foo.com"
 	endpoint.SshPort = "8888"
-	oldGITSSHCommand := config.Config.Getenv("GIT_SSH_COMMAND")
+	oldGITSSHCommand := cfg.Getenv("GIT_SSH_COMMAND")
 	// this will run on non-Windows platforms too but no biggie
 	plink := filepath.Join("Users", "joebloggs", "bin", "tortoiseplink")
-	config.Config.Setenv("GIT_SSH_COMMAND", plink)
-	exe, args := sshGetExeAndArgs(endpoint)
+	cfg.Setenv("GIT_SSH_COMMAND", plink)
+	exe, args := sshGetExeAndArgs(cfg, endpoint)
 	assert.Equal(t, plink, exe)
 	assert.Equal(t, []string{"-batch", "-P", "8888", "user@foo.com"}, args)
 
-	config.Config.Setenv("GIT_SSH_COMMAND", oldGITSSHCommand)
+	cfg.Setenv("GIT_SSH_COMMAND", oldGITSSHCommand)
 }
diff --git a/httputil/ntlm.go b/httputil/ntlm.go
index 712b2638..6cabf483 100644
--- a/httputil/ntlm.go
+++ b/httputil/ntlm.go
@@ -53,7 +53,7 @@ func doNTLMRequest(request *http.Request, retry bool) (*http.Response, error) {
 	//If the status is 401 then we need to re-authenticate, otherwise it was successful
 	if res.StatusCode == 401 {
 
-		creds, err := auth.GetCreds(request)
+		creds, err := auth.GetCreds(config.Config, request)
 		if err != nil {
 			return nil, err
 		}
@@ -83,7 +83,7 @@ func doNTLMRequest(request *http.Request, retry bool) (*http.Response, error) {
 			return doNTLMRequest(challengeReq, false)
 		}
 
-		auth.SaveCredentials(creds, res)
+		auth.SaveCredentials(config.Config, creds, res)
 
 		return res, nil
 	}
diff --git a/httputil/request.go b/httputil/request.go
index e08d2343..f1bfd7a2 100644
--- a/httputil/request.go
+++ b/httputil/request.go
@@ -90,7 +90,7 @@ func doHttpRequest(req *http.Request, creds auth.Creds) (*http.Response, error)
 func DoHttpRequest(req *http.Request, useCreds bool) (*http.Response, error) {
 	var creds auth.Creds
 	if useCreds {
-		c, err := auth.GetCreds(req)
+		c, err := auth.GetCreds(config.Config, req)
 		if err != nil {
 			return nil, err
 		}
@@ -104,7 +104,7 @@ func DoHttpRequest(req *http.Request, useCreds bool) (*http.Response, error) {
 func DoHttpRequestWithRedirects(req *http.Request, via []*http.Request, useCreds bool) (*http.Response, error) {
 	var creds auth.Creds
 	if useCreds {
-		c, err := auth.GetCreds(req)
+		c, err := auth.GetCreds(config.Config, req)
 		if err != nil {
 			return nil, err
 		}
diff --git a/httputil/response.go b/httputil/response.go
index 59b67c2b..a927783d 100644
--- a/httputil/response.go
+++ b/httputil/response.go
@@ -57,7 +57,7 @@ func GetDefaultError(code int) string {
 
 // Check the response from a HTTP request for problems
 func handleResponse(res *http.Response, creds auth.Creds) error {
-	auth.SaveCredentials(creds, res)
+	auth.SaveCredentials(config.Config, creds, res)
 
 	if res.StatusCode < 400 {
 		return nil